According to the CJEU, the GDPR poses an obligation on a controller to provide the data subject, free of charge, with a first copy of its personal data.
The European Court of Justice (CJEU) delivered a ruling leading to major discussions, mandating controllers to inform data subjects of recipients' names upon exercising their privacy right of access under GDPR unless specific exceptions apply.
